See if .NET 8 analyzers have fixed issues with CA1508

[pakdev]

@jonathanou has seen false positives of the .NET 7 implementation of the CA1508 analyzer in internal codebases. The .NET 8 implementation needs to be tested to see if those issues are resolved.

[jonathanou]

Issues still present using the latest preview .NET 8 analyzers. Particularly two issues:

This code got a false positive saying fileStream is never null in the finally block:

FileStream fileStream = null;
try
{
    fileStream = LongPathFile.OpenRead(file);
    using (var reader = new BinaryReader(fileStream))
    {
        fileStream = null;
        byte[] bytes = reader.ReadBytes(_pngHeader.Length);
        return _bmpHeader.SequenceEqual(bytes.Take(_bmpHeader.Length)) || _pngHeader.SequenceEqual(bytes.Take(_pngHeader.Length));
    }
}
catch (IOException)
{
    return false;
}
finally
{
    if (fileStream != null)
    {
        fileStream.Dispose();
    }
}

The second one was the double-lock pattern was not being recognized, saying _systemAssessment == null in the second check is always true:

if (_systemAssessment == null)
{
    lock (_lockObject)
    {
        if (_systemAssessment == null)
        {
            // ...
        }
    }
}

I'll look to create github issues for these issues, but we'll have to keep CA 1508 disabled for now.

[jonathanou]

For the double-locked pattern false-positive, there is already a github issue: dotnet/roslyn-analyzers#1649

For for-loop false-positive (I didn't list this in the reply above, but I did also see this in ASW): dotnet/roslyn-analyzers#3874

I filed a new issue dotnet/roslyn-analyzers#7028 for the fileStream false positive example.

[jonathanou]

Additional info: looking at the open issues related to CA 1508, they are quite numerous and many of them unresolved for multiple years: https://github.com/dotnet/roslyn-analyzers/issues?q=is%3Aissue+is%3Aopen+CA1508